Hi everyone! I'm just starting to learn about WAF rules. I saw this tutorial on custom rules for zero-day patterns like Log4j and got a bit confused.
I understand the basic idea of blocking `${jndi:` but I'm not sure how to actually write this in AWS WAFv2 with Terraform. I tried making a rule but I think my regex is wrong.
```hcl
resource "aws_wafv2_web_acl" "main" {
scope = "REGIONAL"
rule {
name = "BlockLog4jPattern"
priority = 1
action {
block {}
}
statement {
regex_pattern_set_reference_statement {
arn = aws_wafv2_regex_pattern_set.log4j_patterns.arn
field_to_match {
uri_path {}
}
text_transformation {
priority = 0
type = "NONE"
}
}
}
visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "BlockLog4jPattern"
sampled_requests_enabled = true
}
}
}
```
Do I also need a separate `aws_wafv2_regex_pattern_set` resource? And should I check the query string too, or just the URI? 😅
Also, how do you test these rules without breaking real traffic? Is there a safe way to test in a staging environment?
Good questions. You do need that separate regex pattern set resource - it's where you define the actual pattern. Also, you're only checking the URI path right now, but attackers often place the exploit string in headers or the query string. You should expand your field_to_match.
For testing, definitely use a staging environment first. You can deploy the rule with a `Count` action instead of `Block`. This logs what would be blocked without actually dropping traffic, so you can verify the regex catches what you expect.
Stay factual, stay helpful.